ReccoBill Privacy Policy

The short version. Your bank statements are read on your phone and never uploaded. ReccoBill has no accounts, no sign-in, no analytics and no advertising. The only thing the app downloads is a public list of merchant names, and payments are handled by Google Play, not by us. One optional paid feature, Pro AI, does send something: a sheet’s layout without its values, or a bank descriptor with its numbers stripped, and only when you ask it to and confirm what is going. Everything about it is below.

This policy covers the ReccoBill Android app. The B&E Media Privacy Policy covers this website and anything not described here.

Data summary

What you give ReccoBill

• Bank statements you choose from your phone: a CSV export from your bank, a statement PDF from your bank, or a PayPal activity statement.
• Anything you type in: subscriptions you add by hand, names, amounts, dates, categories, notes, and names you give to merchants ReccoBill could not identify.

What happens to it

Statements are read entirely on your device. ReccoBill looks for charges that repeat and shows you what it found; nothing is added until you accept it. The statement file itself is not copied, kept or sent anywhere.

What it keeps, in its private storage on your phone, is the register you build: each subscription or regular payment, its amounts, the dates of the charges behind it, the bank descriptor, and the account it was charged to as the statement labels it (which can include the account number, so transfers between your own accounts are not mistaken for spending). We cannot see any of it.

Where copies can exist

• Not in Google Drive.ReccoBill opts out of Android’s automatic cloud backup, so the register is never uploaded by the system on your behalf.
• A new phone.If you move to a new Android phone with Android’s own phone-to-phone transfer, the register can be copied across as part of that transfer, which you start yourself.
• Backups and spreadsheets you export.These go to your phone’s share menu and only where you send them — Drive, email, a folder. They are not encrypted, so anyone who can open that place can read them. A temporary copy is written to the app’s private cache to hand to the share menu; Android may keep it there until the cache is cleared.
• Notifications.Renewal reminders are scheduled and shown by your phone. They include the subscription’s name and amount, and depending on your lock-screen settings may be visible without unlocking.

What leaves your phone

The merchant name list. ReccoBill downloads a public list of bank descriptors and the services they belong to from reccobill.web.app, hosted on Google’s Firebase Hosting. It is an ordinary file download over HTTPS and sends nothing about you or your register. As with any web request, the hosting service necessarily sees your IP address and basic request details such as the time; we do not use these to identify or locate you.

Purchases. If you buy Plus, the purchase is made through Google Play. Google collects and processes your payment details under Google’s privacy policy; ReccoBill never sees them. The app asks Google Play which plan you have and remembers the answer on your phone. We receive no account, name or email from the purchase.

Merchant names you choose to share — not active yet. You may tick a box to share a name you gave a merchant, so other people’s imports recognise the same biller. There is no server receiving these yet, so ticking the box today records your answer and sends nothing. If a future version starts sending them, exactly two things would be sent: the bank descriptor with reference numbers stripped, and the name you gave it, with a random identifier generated on your device so repeat submissions can be told apart. No such identifier exists in this version.

Never sent, whatever plan you are on:

• your statement files, or any amount, balance or date from them
• account numbers, your bank, or what anything costs you
• which subscriptions you have, or how many
• your name, email, phone number, contacts or location

The only things that ever leave are the ones named above: the merchant name list coming down, and — on Pro AI, at your request — a sheet’s layout without its values, or a descriptor with its numbers stripped.

No sign-in, no tracking

ReccoBill has no login: no email, no password, nothing to sign up for. The one exception is Pro AI, which creates an anonymous id on first use so that credits belong to somebody — it holds no name, email or password, and it is deleted when you ask.

The app contains no analytics, no advertising, no crash reporting to third parties, and no social or marketing trackers. It never connects to your bank and cannot move money.

These are all the Android permissions it uses:

• Internet and network state— to download the merchant name list and to reach Google Play for purchases.
• Notifications, Alarms & reminders and vibration— so a renewal reminder arrives, and can be felt, on the day it is due.
• Run at startup— to put reminders back after the phone restarts.
• Google Play billing— to buy a paid plan.

Keeping and deleting your data

Your register stays on your phone until you delete it. You can delete any entry in the app, clear everything from Android’s settings (Apps → ReccoBill → Storage → Clear storage), or uninstall the app, which removes it. Exported backups are yours to delete wherever you put them. Because we hold no copy of your data there is nothing on our side to access, correct or delete, and ReccoBill does not appear on the account deletion page for that reason.

Pro AI

Pro AI is an optional paid plan. Without it, nothing in this section happens and the app never contacts our server or any AI service. With it, two jobs can be asked for, one at a time, and each shows you exactly what would be sent before it goes.

Reading a sheet nobody could read.When a spreadsheet or export does not look like any layout ReccoBill knows, you can ask Pro AI to work out which column is which. What is sent is the shape of the file, not the file: how many columns and rows it has, what kind of thing each column holds (dates, amounts, text, how full and how varied), the shape of its first fifteen rows, and a column heading only where that heading cannot itself be a value — “Transaction date” goes, a merchant name does not. No amount, date, description, balance or name from the file is sent. The answer is a column mapping, and your phone then reads the file itself.

Naming a merchant.You can ask Pro AI to identify charges nobody could name. What is sent is the bank descriptors, with runs of four or more digits, email addresses and web links removed, under a neutral label (“m0”, “m1”). No amounts, no dates, no account numbers, nothing about your other subscriptions. Answers come back as suggestions with a source link where there is one; nothing is added to your register until you accept it.

Where it goes. To our server (Google Cloud Functions in Sydney), which passes it to OpenAIand returns the answer. OpenAI processes the request on servers outside Australia. It is asked not to store the request or response, and API data is not used to train its models; it may keep abuse-monitoring logs for up to 30 days. We keep counts and timings so we can see how much the feature is used — never the content.

What Pro AI needs to work.An anonymous account, created on first use: an id with no email, name or password attached, which exists so your credits are yours and not somebody else’s. Your Google Play purchase is checked with Google, and your remaining credits and subscription are stored against that id in Sydney. Your phone also proves it is a genuine ReccoBill install (Google Play Integrity) so that the service cannot be run up by a script.

Deleting it. Ask us through the account deletionpage and choose ReccoBill (Pro AI), and the anonymous id, its credits and its subscription record are deleted. Your register is on your phone and is not ours to delete — that part is still yours alone.

Children

ReccoBill is a personal finance tool for adults. It is not directed at children and collects nothing about them.

Changes

If this policy changes, the date at the top changes with it. Any change that would send more than is described here will be explained in the app before it takes effect.

Contact

Questions or a request about your data: admin@bandemedia.com.